aws-samples / aws-samples/aws-cloudhsm-jce-examples

More realistic symmetric key export example

Open
#50 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
46
Forks
70
Avg merge
52m
Merged PRs (30d)
4

Description

A common key exchange operation is that a "client" provides a public (RSA or EC) key to the HSM, the HSM generates a symmetric key encrypted under that public key, and the client then imports the symmetric key into its own keystore. (This is a toy example of how key exchange between HSMs and mobile devices works.) The existing code samples provide hints at how to accomplish each of these steps _except_ importing the public key; [RSAImportKey](https://github.com/aws-samples/aws-cloudhsm-jce-examples/blob/master/src/main/java/com/amazonaws/cloudhsm/examples/RSAImportKey.java) does something similar but in the opposite direction.

An end-to-end example for exporting an AES key using this flow would be welcome.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the existing code samples and RSAImportKey.java, which demonstrates the related reverse-direction public-key import. Trace how the examples handle public-key import, HSM-generated symmetric keys, and client-side keystore import. Done means an end-to-end example exporting an AES key encrypted under a client RSA or EC public key.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
cryptography, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.